How to make an international phone call

Example, call from Malaysia to USA

00 + 1 +

Area Code

+ Tel #

00 = Country exit code
1 =  Country code which is USA

Reference:
Call from  Malaysia to United States
http://www.countrycodes.com/search_usa.php?t=250&f=146

Country Codes for International Calling & Area Codes
http://www.countrycodes.com/

tcpdump

How to find right interface 

route get 
netstat -nr


To list all network interfaces
tcpdump -D
ifconfig -a | grep :

To capture traffic from interface eth0, source ip = 10.10.10.10 & destination ip = 10.10.10.11
tcpdump -i eth0 src 10.10.10.10 and dst 10.10.10.11

Reference:

Manpage of TCPDUMP

http://www.tcpdump.org/tcpdump_man.html

A tcpdump Tutorial and Primer
http://danielmiessler.com/study/tcpdump/

Check The Routes
http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Check_The_Routes

Using TCPdump

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch35_:_Configuring_Linux_VPNs#Using_TCPdump

SANS POCKET REFERENCE GUIDE: TCP/IP and tcpdump
http://www.sans.org/security-resources/tcpip.pdf?ref=3871

Checkpoint: fw monitor

Let say we want to monitor the following informations:

Source IP = 10.10.10.10
Destination IP = 10.10.10.11

[Expert@cpmodule]# fw monitor -e 'accept src=10.10.10.10 or dst=10.10.10.11;'
monitor: getting filter (from command line)
monitor: compiling
monitorfilter:
Compiled OK.
monitor: loading
monitor: monitoring (control-C to stop)
^C
monitor: caught sig 2
monitor: unloading
[Expert@cpmodule]# cat $FWDIR/tmp/monitorfilter.pf
#define src ip_src
#define dst ip_dst
#define sport th_sport
#define dport th_dport
#include "tcpip.def"
accept src=10.10.10.10 or dst=10.10.10.11;

Reference:
How to use fw monitor (page 36)
http://www.checkpoint.com/techsupport/downloads/html/ethereal/fw_monitor_rev1_01.pdf

FW MONITOR
http://www.cpug.org/check_point_resources/FW MONITOR_expert.doc

Cisco: View Active SSH Sessions

Issue this command in order to check the number of SSH sessions that are connected and the connection state to the PIX:

pix#show ssh session
 
SID Client IP       Version Mode Encryption Hmac     State            Username
0   10.1.1.2        1.99    IN   aes128-cbc md5      SessionStarted   pix
                            OUT  aes128-cbc md5      SessionStarted   pix

Reference:
PIX/ASA 7.x: SSH/Telnet on the Inside and Outside Interface Configuration Example
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008069bf1b.shtml#active

Cisco: View Active Telnet Sessions - who

who

To display active Telnet administration sessions on the adaptive security appliance, use the who command in privileged EXEC mode. 

Usage Guidelines

The who command allows you to display the TTY_ID and IP address of each Telnet client that is currently logged into the adaptive security appliance.

Examples

This example shows the output of the who command when a client is logged into the adaptive security appliance through a Telnet session:

hostname# who

0: 100.0.0.2

hostname# who 100.0.0.2

0: 100.0.0.2

hostname#

Related Commands

Command	Description
kill	Terminate a Telnet session.
telnet	Adds Telnet access to the adaptive security appliance console and sets the idle timeout.

Reference:
who
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/uz.html#wp1634239

How to find source interface or right access-list group

1. Check source ip
2. show route | grep

3.1. show run | grep access-group for Cisco PIX
or
3.2. show run access-group Cisco ASA

Cisco ASA: Packet-Tracer

The packet-tracer command lets you do the following:

• Debug all packet drops in production network.
• Verify the configuration is working as intended.
• Show all rules applicable to a packet along with the CLI lines which caused the rule addition.
• Show a time line of packet changes in a data path.
• Inject tracer packets into the data path.

The packet-tracer command provides detailed information about the packets and how they are processed by the security appliance. In the instance that a command from the configuration did not cause the packet to drop, the packet-tracer command will provide information about the cause in an easily readable manner. For example if a packet was dropped because of an invalid header validation, a message is displayed that says, “packet dropped due to bad ip header (reason).”

How to use packet-tracer

packet-tracer input [src_int] protocol src_addr src_port dest_addr dest_port [detailed] [xml]

src_int = Source Interface
protocol = icmp / rawip / tcp / udp

src_addr = Source IP Address
src_port = Source port
dst_addr = Destination IP Address
dst_port = Destination port


Examples:
1. To enable packet tracing from inside host 10.2.25.3 to external webserver 209.165.202.158, enter the following

ASA5510# packet-tracer input inside tcp 10.2.25.3 3000 209.165.202.158 http
or
ASA5510# packet-tracer input inside tcp 10.2.25.3 3000 209.165.202.158 80

where;
inside  is Source Interface
tcp  is protocol
10.2.25.3 is Source IP Address
3000 is Source port
209.165.202.158 is Destination IP Address

http / 80 is Destination port

Reference:
Cisco ASA Troubleshooting Tool Kit
http://www.networkblueprints.com/troubleshooting/cisco-asa-troubleshooting-tool-kit

PIX/ASA 7.2(1) and later: Intra-Interface Communications
http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080734db7.shtml

Packet capture and sniffing using the Cisco ASA Firewall
http://www.networkstraining.com/packet-capture-and-sniffing-using-the-cisco-asa-firewall/

Cisco ASA troubleshooting command packet-tracer
http://informationsecuritytips.com/2009/04/cisco-asa-troubleshooting-command-packet-tracer/